> From: Qiang.zhang>
> rcu: INFO: rcu_preempt self-detected stall on CPU
> rcu: 1-...!: (2 ticks this GP) idle=d92/1/0x4000000000000000
> softirq=25390/25392 fqs=3
> (t=12164 jiffies g=31645 q=43226)
> rcu: rcu_preempt kthread starved for 12162 jiffies! g31645 f0x0
> RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
> rcu: Unless rcu_preempt kthread gets sufficient CPU time,
> OOM is now expected behavior.
> rcu: RCU grace-period kthread stack dump:
> task:rcu_preempt state:R running task
> ...........
> usbtmc 3-1:0.0: unknown status received: -71 usbtmc 3-1:0.0: unknown status
> received: -71 usbtmc 3-1:0.0: unknown status received: -71 usbtmc 3-1:0.0:
> unknown status received: -71 usbtmc 3-1:0.0: unknown status received: -71 usbtmc
> 3-1:0.0: unknown status received: -71 usbtmc 3-1:0.0: unknown status received: -71
> usbtmc 3-1:0.0: unknown status received: -71 usbtmc 3-1:0.0: usb_submit_urb
> failed: -19
>
> The function usbtmc_interrupt() resubmits urbs when the error status of an urb is -
> EPROTO. In systems using the dummy_hcd usb controller this can result in endless
> interrupt loops when the usbtmc device is disconnected from the host system.
>
> Since host controller drivers already try to recover from transmission errors, there is
> no need to resubmit the urb or try other solutions to repair the error situation.
>
> In case of errors the INT pipe just stops to wait for further packets.
>
> Fixes: dbf3e7f654c0 ("Implement an ioctl to support the USMTMC-USB488
> READ_STATUS_BYTE operation")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: syzbot+e2eae5639e7203360018@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Qiang.zhang <qiang.zhang@xxxxxxxxxxxxx>
> ---
> v1->v2:
> Add fixes and stable tags, modify description information.
>
> drivers/usb/class/usbtmc.c | 9 +--------
> 1 file changed, 1 insertion(+), 8 deletions(-)
>
> diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index
> 74d5a9c5238a..73f419adce61 100644
> --- a/drivers/usb/class/usbtmc.c
> +++ b/drivers/usb/class/usbtmc.c
> @@ -2324,17 +2324,10 @@ static void usbtmc_interrupt(struct urb *urb)
> dev_err(dev, "overflow with length %d, actual length is %d\n",
> data->iin_wMaxPacketSize, urb->actual_length);
> fallthrough;
> - case -ECONNRESET:
> - case -ENOENT:
> - case -ESHUTDOWN:
> - case -EILSEQ:
> - case -ETIME:
> - case -EPIPE:
> + default:
> /* urb terminated, clean up */
> dev_dbg(dev, "urb terminated, status: %d\n", status);
> return;
> - default:
> - dev_err(dev, "unknown status received: %d\n", status);
> }
> exit:
> rv = usb_submit_urb(urb, GFP_ATOMIC);
> --
> 2.25.1
The patch looks good to me and is tested on my machine.
Ack-by: Guido Kiener <guido.kiener@xxxxxxxxxxxxxxxxx>
-Guido
